Privacy Policy

The short version

Rydex needs an account to hang your garage on, the photos of the car you want to tune, and a payment status if you subscribe. Scanning adds two more, both optional: where you were when you scanned, and a recording of the engine if you make one. We do not sell your data and we do not use your photos to train models. We do measure how the app is used, and we do use a device advertising identifier to work out which ad or link brought you here. All of it is spelled out below.

What we collect

Account details — your email address, plus the name and email Apple or Google hand back if you use those sign-in buttons. Authentication runs through Supabase, so your password never reaches us.
Your cars — the photos you upload, the previews generated from them, and the notes and goals you attach to a build.
Subscription status — whether you have an active plan. Purchases run through Apple and RevenueCat, so card numbers never reach us either.
Service logs — request timestamps and error traces kept by our API host, used to keep the thing running and nothing else.
Usage data — which screens you open, when a render starts and whether it worked, and whether you were shown the subscription screen. Linked to your account id once you sign in, so we can follow one journey rather than a pile of anonymous taps. Never your photos, and never the contents of a render.
Where you scanned — if you allow location access, a scan is stamped with the position it was taken at. That is what puts your finds on the map. See “Where you scanned, and what others see” below.
Engine recordings — if you record the sound of a car, that audio clip is uploaded and stored against the scan.
A device advertising identifier — the Google Advertising ID on Android, the Apple identifier on iOS, used to attribute your install to the ad or link you came from. See “Advertising and attribution” below.
Crash reports — when the app fails, the technical detail of the failure and your account id, so we can find the bug.

What happens to your photos

When you add a car, the photo is uploaded to our storage and then passed to our image-generation provider, which renders the part onto it and hands the result back. Both the original and the render stay in your garage until you delete them.

Those files are served from a public storage bucket under long, unguessable paths. That is what lets the renderer and the app fetch them — but it also means anyone holding the exact link can open the image. Treat a car photo as shareable, and keep plates, faces, house numbers and documents out of frame if you would rather they were not.

Every preview is an AI-generated concept, not a photograph of a real installation.

Where you scanned, and what others see

If you grant location access, each scan is stamped with where it was taken and appears as a pin on the in-app map, where other drivers can see it. Before a pin leaves our server the position is rounded to a coarse grid roughly a kilometre across, so it shows the area a car was spotted in rather than an address — but it is still shared with other people, so treat scanning at home as something others will see. Decline the permission, or turn it off later in your device settings, and scanning still works; the finds simply do not go on the map.

Engine recordings are optional and only happen while you hold the record control. The clip is uploaded and stored with the scan and plays back the same way the photo is shown. The microphone is not used at any other time.

Advertising and attribution

Rydex carries no ads. It does use AppsFlyer to work out which ad, link or campaign led to an install, which is how we know where to spend. AppsFlyer receives your device advertising identifier, the install itself, and a small number of events such as a completed purchase — never your photos, your cars or your location. Because that identifier can follow a device between apps, Apple and Google both classify this as tracking; on iOS the app asks before any of it happens, and on either platform you can reset or limit the identifier in your device settings.

Who else is involved

Supabase — accounts, database and image storage.
KIE AI — the image model that renders your parts. It receives the car photo and the part image for the length of the job.
Apple and RevenueCat — subscription handling and receipt validation.
Amazon Web Services — hosting for our API and for this website.
PostHog — product analytics. It receives the in-app actions described above and your account id, never your photos.
AppsFlyer — install attribution, as described above. It receives your device advertising identifier and install and purchase events.
Sentry — crash reporting. It receives the technical detail of a crash and your account id.
fal.ai — a second image and 3D-model provider used alongside KIE AI. It receives the same car and part images, for the length of the job.
ElevenLabs — generates the spoken lines you hear in the app. It receives the text to be spoken and nothing about you.
Google — Maps and Places draw the in-app map and receive the coarse positions described above. Google Play handles purchases on Android.

That is the whole list, and we update it when it changes. None of them is a data broker and none of them is paid for your data. The one to be clear about is AppsFlyer: it is an advertising-attribution service, so the advertising identifier it handles is matched against the ad platform that ran the campaign you arrived from.

How long we keep things

Cars, photos and generated builds stay until you delete them or close your account. Deleting the account removes the garage and the images stored against it. Service logs roll off within 30 days.

Your rights

You can ask for a copy of your data, have it corrected, or have it deleted — write to support@thetuninglab.com from the address on your account and we will action it. If you are in the EU or the UK you also have the right to object to processing and to complain to your local data protection authority.

This website

thetuninglab.com is a set of static pages on a CDN. It sets no cookies and stores nothing in your browser: page visits are counted in cookieless mode, where PostHog derives a short-lived, non-reversible identifier server-side instead of tagging your device. Nothing here follows you to another site, and the language you land in comes from your own browser setting and is never sent anywhere.

Children

Rydex is not aimed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If this policy changes in a way that affects what we collect or who we share it with, the date at the top of this page changes with it, and material changes are flagged in the app.